Ruleset Update Summary - 2022/12/27 - v10205

Ruleset Updates
1

Summary:

18 new OPEN, 20 new PRO (18 + 2)

Thanks @0xrb, @ViriBack, @DuskRiseInc, @_CPResearch_, NoahWolf

The Emerging Threats mailing list is migrating to Discourse. Please visit us at https://community.emergingthreats.net

We will announce the mailing list retirement date in the near future.

Added rules:

Open:

  • 2043008 - ET ADWARE_PUP Win32/Atshz.A Checkin (adware_pup.rules)
  • 2043009 - ET ADWARE_PUP Win32/Atshz.A Checkin M2 (adware_pup.rules)
  • 2043010 - ET EXPLOIT Possible Cacti Unauthenticated RCE Inbound M1 (CVE-2022-46169) (exploit.rules)
  • 2043011 - ET EXPLOIT Possible Cacti Unauthenticated RCE Inbound M2 (CVE-2022-46169) (exploit.rules)
  • 2043012 - ET MALWARE Antinum WebSockets Start (malware.rules)
  • 2043013 - ET MALWARE Antinum HTTP Checkin (malware.rules)
  • 2043014 - ET MALWARE Win32/Drokbk Checkin Activity (GET) (malware.rules)
  • 2043015 - ET MALWARE CloudAtlas APT Related Domain in DNS Lookup (malware.rules)
  • 2043016 - ET MALWARE CloudAtlas APT Related Domain in DNS Lookup (malware.rules)
  • 2043017 - ET MALWARE Aurora Stealer Admin Console In HTTP Response (malware.rules)
  • 2043018 - ET MALWARE Observed DNS Query to Alibaba2044 Domain (service-fatturecloud .de) (malware.rules)
  • 2043019 - ET MALWARE Observed DNS Query to Alibaba2044 Domain (utente .service-fatturecloud .de) (malware.rules)
  • 2043020 - ET MALWARE Observed DNS Query to Alibaba2044 Domain (downloadpdf-fattura .de) (malware.rules)
  • 2043021 - ET PHISHING Facebook Credential Phish Landing Page 2022-12-27 (phishing.rules)
  • 2043022 - ET PHISHING Generic Credential Phish Landing Page 2022-12-27 (phishing.rules)
  • 2043023 - ET MALWARE TA444/Lazarus Related Domain in DNS Lookup (thedoodles .site) (malware.rules)
  • 2043024 - ET MALWARE SocGholish Domain in DNS Lookup (people .fl2wealth .com) (malware.rules)
  • 2043025 - ET MALWARE SocGholish Domain in DNS Lookup (taxes .rpacx .com) (malware.rules)

Pro:

  • 2852982 - ETPRO PHISHING Twitter Phish Landing Page 2022-12-23 (phishing.rules)
  • 2852983 - ETPRO PHISHING Successful Twitter Credential Phish 2022-12-23 (phishing.rules)

Modified active rules:

  • 2810290 - ETPRO MALWARE NanoCore RAT Keepalive Response 1 (malware.rules)

Removed rules:

  • 2042766 - ET INFO localtunnel Tunneling Domain in DNS Lookup (localtunnel .me) (info.rules)
  • 2830630 - ETPRO ADWARE_PUP Win32/Atshz.A Checkin (adware_pup.rules)
  • 2830631 - ETPRO ADWARE_PUP Win32/Atshz.A Checkin M2 (adware_pup.rules)